fix(security): pentest remediation — condition escaping, SSRF hardening, ReDoS protection

apps/sim/app/api/function/execute/route.test.ts

@@ -26,6 +26,14 @@ vi.mock('@/lib/execution/e2b', () => ({
  executeInE2B: mockExecuteInE2B,
 }))
 
+vi.mock('@/lib/core/config/feature-flags', () => ({
+ isHosted: false,
+ isE2bEnabled: false,
+ isProd: false,
+ isDev: false,
+ isTest: true,
+}))
+
 import { validateProxyUrl } from '@/lib/core/security/input-validation'
 import { POST } from '@/app/api/function/execute/route'
 

apps/sim/executor/variables/resolver.ts

@@ -236,7 +236,13 @@ export class VariableResolver {
  }
 
  if (typeof resolved === 'string') {
- const escaped = resolved.replace(/\\/g, '\\\\').replace(/'/g, "\\'")
+ const escaped = resolved
+ .replace(/\\/g, '\\\\')
+ .replace(/'/g, "\\'")
+ .replace(/\n/g, '\\n')
+ .replace(/\r/g, '\\r')
+ .replace(/\u2028/g, '\\u2028')
+ .replace(/\u2029/g, '\\u2029')
  return `'${escaped}'`
  }
  if (typeof resolved === 'object' && resolved !== null) {

apps/sim/lib/core/security/input-validation.server.ts

@@ -4,6 +4,7 @@ import https from 'https'
 import type { LookupFunction } from 'net'
 import { createLogger } from '@sim/logger'
 import * as ipaddr from 'ipaddr.js'
+import { isHosted } from '@/lib/core/config/feature-flags'
 import { type ValidationResult, validateExternalUrl } from '@/lib/core/security/input-validation'
 
 const logger = createLogger('InputValidation')
@@ -89,10 +90,7 @@ export async function validateUrlWithDNS(
  return ip === '127.0.0.1' || ip === '::1'
  })()
 
- if (
- isPrivateOrReservedIP(address) &&
- !(isLocalhost && resolvedIsLoopback && !options.allowHttp)
- ) {
+ if (isPrivateOrReservedIP(address) && !(isLocalhost && resolvedIsLoopback && !isHosted)) {
  logger.warn('URL resolves to blocked IP address', {
  paramName,
  hostname,

apps/sim/lib/core/security/input-validation.test.ts

@@ -23,6 +23,9 @@ import { validateUrlWithDNS } from '@/lib/core/security/input-validation.server'
 import { sanitizeForLogging } from '@/lib/core/security/redaction'
 
 vi.mock('@sim/logger', () => loggerMock)
+vi.mock('@/lib/core/config/feature-flags', () => ({
+ isHosted: false,
+}))
 
 describe('validatePathSegment', () => {
  describe('valid inputs', () => {
@@ -569,25 +572,25 @@ describe('validateUrlWithDNS', () => {
  expect(result.error).toContain('https://')
  })
 
- it('should accept https localhost URLs', async () => {
+ it('should accept https localhost URLs (self-hosted)', async () => {
  const result = await validateUrlWithDNS('https://localhost/api')
  expect(result.isValid).toBe(true)
  expect(result.resolvedIP).toBeDefined()
  })
 
- it('should accept http localhost URLs', async () => {
+ it('should accept http localhost URLs (self-hosted)', async () => {
  const result = await validateUrlWithDNS('http://localhost/api')
  expect(result.isValid).toBe(true)
  expect(result.resolvedIP).toBeDefined()
  })
 
- it('should accept IPv4 loopback URLs', async () => {
+ it('should accept IPv4 loopback URLs (self-hosted)', async () => {
  const result = await validateUrlWithDNS('http://127.0.0.1/api')
  expect(result.isValid).toBe(true)
  expect(result.resolvedIP).toBeDefined()
  })
 
- it('should accept IPv6 loopback URLs', async () => {
+ it('should accept IPv6 loopback URLs (self-hosted)', async () => {
  const result = await validateUrlWithDNS('http://[::1]/api')
  expect(result.isValid).toBe(true)
  expect(result.resolvedIP).toBeDefined()
@@ -918,7 +921,7 @@ describe('validateExternalUrl', () => {
  })
  })
 
- describe('localhost and loopback addresses', () => {
+ describe('localhost and loopback addresses (self-hosted)', () => {
  it.concurrent('should accept https localhost', () => {
  const result = validateExternalUrl('https://localhost/api')
  expect(result.isValid).toBe(true)
@@ -1027,7 +1030,7 @@ describe('validateImageUrl', () => {
  expect(result.isValid).toBe(true)
  })
 
- it.concurrent('should accept localhost URLs', () => {
+ it.concurrent('should accept localhost URLs (self-hosted)', () => {
  const result = validateImageUrl('https://localhost/image.png')
  expect(result.isValid).toBe(true)
  })

apps/sim/lib/core/security/input-validation.ts

@@ -1,5 +1,6 @@
 import { createLogger } from '@sim/logger'
 import * as ipaddr from 'ipaddr.js'
+import { isHosted } from '@/lib/core/config/feature-flags'
 
 const logger = createLogger('InputValidation')
 
@@ -710,20 +711,21 @@ export function validateExternalUrl(
  }
  }
 
+ if (isLocalhost && isHosted) {
+ return {
+ isValid: false,
+ error: `${paramName} cannot point to localhost`,
+ }
+ }
+
  if (options.allowHttp) {
  if (protocol !== 'https:' && protocol !== 'http:') {
  return {
  isValid: false,
  error: `${paramName} must use http:// or https:// protocol`,
  }
  }
- if (isLocalhost) {
- return {
- isValid: false,
- error: `${paramName} cannot point to localhost`,
- }
- }
- } else if (protocol !== 'https:' && !(protocol === 'http:' && isLocalhost)) {
+ } else if (protocol !== 'https:' && !(protocol === 'http:' && isLocalhost && !isHosted)) {
  return {
  isValid: false,
  error: `${paramName} must use https:// protocol`,

apps/sim/lib/guardrails/validate_regex.ts

@@ -1,3 +1,5 @@
+import safe from 'safe-regex2'
+
 /**
  * Validate if input matches regex pattern
  */
@@ -7,15 +9,23 @@ export interface ValidationResult {
 }
 
 export function validateRegex(inputStr: string, pattern: string): ValidationResult {
+ let regex: RegExp
  try {
- const regex = new RegExp(pattern)
- const match = regex.test(inputStr)
-
- if (match) {
- return { passed: true }
- }
- return { passed: false, error: 'Input does not match regex pattern' }
+ regex = new RegExp(pattern)
  } catch (error: any) {
  return { passed: false, error: `Invalid regex pattern: ${error.message}` }
  }
+
+ if (!safe(pattern)) {
+ return {
+ passed: false,
+ error: 'Regex pattern rejected: potentially unsafe (catastrophic backtracking)',
+ }
+ }
+
+ const match = regex.test(inputStr)
+ if (match) {
+ return { passed: true }
+ }
+ return { passed: false, error: 'Input does not match regex pattern' }
 }

apps/sim/package.json

@@ -116,8 +116,8 @@
  "es-toolkit": "1.45.1",
  "ffmpeg-static": "5.3.0",
  "fluent-ffmpeg": "2.1.3",
- "free-email-domains": "1.2.25",
  "framer-motion": "^12.5.0",
+ "free-email-domains": "1.2.25",
  "google-auth-library": "10.5.0",
  "gray-matter": "^4.0.3",
  "groq-sdk": "^0.15.0",
@@ -174,6 +174,7 @@
  "remark-gfm": "4.0.1",
  "resend": "^4.1.2",
  "rss-parser": "3.13.0",
+ "safe-regex2": "5.1.0",
  "sharp": "0.34.3",
  "soap": "1.8.0",
  "socket.io": "^4.8.1",